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REMARKS 

Claims 1-12, 14-20 and 22-83 are pending in this application. By this Amendment, 
claims 1, 2, 5, 1 1, 19, 57 and 59 are amended, claims 13 and 21 are canceled, and claims 25- 
36, 55, 56, 68-72 and 80-83 are withdrawn. No new matter is added. 

Applicant appreciates the courtesies shown to Applicant's representative by Examiner 
Ho in the telephone interview and October 1 8 personal interview. Applicant's separate record 
of the substance of the interview is incorporated into the following remarks. 

I. Support for Claim Amendments 

Support for amendment to claim 1 can be found at least at page 64, line 27 - page 65, 
line 6. Claims 2 and 5 are amended for form. Support for amendment to claim 1 1 can found 
at least in the cancelled subject matter of claim 13. Support for amendment to claim 19 can 
be found at least in the cancelled subject matter of claim 21. Support for amendments to 
claims 57 and 59 can be found at least at pg. 42, line 5 - pg. 43, line 5. Thus, no new matter is 
added. 

II. Improper Rejection 

The Office Action fails to provide the reasoning the rejection of at least of claims 38- 
54, 65, 66, 77 and 78 under § 103(a) over "Information Security Policies and Procedures: A 
Practitioner's Guide 11 by Thomas Peltier. As agreed upon during a telephone interview, 
Examiner Ho will issue a non-Final Office Action in response to this communication. 

III. Rejection Under 35 ILS.C. §101 

The Office Action rejects claims 1-24, 37-54, 57-67 and 73-79 under 35 U.S.C. §101, 
as being directed to non-statutory subject matter and for lacking utility. This rejection is 
respectfully traversed. 

Claims 13 and 21 are canceled, and thus the rejection of thee claims is now moot. 
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A. The Claims Include Statutory Subject Matter 

The Office Action alleges that claims 1-24, 37-54, 57-67 and 73-79 recite an abstract 
idea "since a security policy in itself, even if established is neither a process, machine, 
manufacture or composition of matter but is a common idea or concept shared among 
members of an organization." See page 4 of the Office Action. This assertion is respectfully 
traversed. 

As indicated in MPEP §706. 03(a), the limits of the statutory classes have been 
determined by various court decisions. For example, the Supreme Court has explicitly 
identified abstract ideas, laws of nature and natural phenomenon as non-statutory subject 
matter. See Diamond v. Diehr, 450 U.S. 175 (1981). As such, MPEP §2106 indicates that 
statutory subject matter requires that a claimed process must be limited to a practical 
application of the abstract idea in the technical arts. See In re Alappat, 33 F.3d 1 526 (Fed. 
Cir. 1994). 

The claims do not merely recite a security policy. Instead, for example, independent 
claims 1,11 and 57 recite a method of establishing a security policy, independent claims 19 
and 59 recite an apparatus of establishing a security policy, and independent claims 61 and 73 
recite a computer readable recording medium and a computer program to establish a security 
policy. That is, the method, apparatus, recording medium and computer program establish a 
security policy. The claimed security policy defined in the specification as a method for 
designing and implementing information security of the entire organization in order to 
enhance the information security level of an entire organization. See, e.g., page 2, lines 15- 
17. However, even if a security policy is considered an abstract idea, the claims are directed 
to a practical application of establishing a security policy, not to a security policy itself Thus, 
at least the independent claims, produce a "useful, concrete and tangible" result. 
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Thus, for at least the reasons discussed above, claims 1, 11, 19, 57, 59, 61 and 73 
constitute statutory subject matter. Further, claims 2-10, 12, 14-18, 20, 22-24, 37-54, 58, 60, 
62-67 and 74-79, which variously depend from independent claims 1, 11, 19, 57, 59, 61 and 
73, constitute statutory subject matter, for at least the reasons discussed with respect to the 
claims 1,11, 19, 57, 59, 61 and 73, as well as the additional features recited therein. 
B. The Claims Do Not Lack Utility 

The Office Action asserts that claims 1-24, 37-54, 57-67, 73-79 are rejected under 35 
U.S.C. §101 because the disclosed invention is inoperative, and therefore lacks utility. 
Specifically, the Examiner asserts that no security policy has been established in claim 1, and 
the mere adjustment of a security policy draft is not tantamount to establishing the actual 
security policy, and concludes that the method recited is inoperative. These assertions are 
respectfully traversed for at least two reasons. 

First, the rejection under 35 U.S.C. §101 for lacking utility is improper. The U.S. 
Patent and Trademark Office has failed to establish a prima facie case that the claimed 
invention lacks utility. 

To properly reject a claimed invention under 35 U.S.C. §101, the U.S. Patent and 
Trademark Office must 1) make a prima facie showing that the claimed invention lacks utility 
and 2) provide a sufficient evidentiary basis for factual assumptions relied upon in 
establishing the prima facie showing. In re Gaubert, 534 F.2d 1222, 1224, 187 USPQ 664, 
666 (CCPA 1975). "If the Office Action cannot develop a proper prima facie case and 
provide evidentiary support for a rejection under 35 U.S.C. 101, a rejection on this ground 
should not be imposed." See, e.g., In re Oetiker, 997 F.2d 1443, 1445, 24 USPQ2d 1443, 
1444 (Fed. Circ. 1992). See, e.g., also MPEP §2107.02 IV. 

As indicated in MPEP §2107.02 IV, a prima facie case must contain the following 
elements: 1) an explanation that clearly sets the reasoning in concluding that the asserted 
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utility is not credible; 2) support for factual findings relied upon in reaching this conclusion; 
and 3) an evaluation of all relevant evidence of record, including utilities taught in the closest 
prior art. 

However, the Examiner failed to meet his burden. The Examiner has not provided a 
reasoning for concluding that the application is inoperative. Thus, Examiner has failed to 
establish a prima facie case of disclosed invention being inoperative. 

Even if the Examiner has established a prima facie case, the claimed invention is not 
inoperative. 

"An invention that is inoperative (i.e. does not operate to produce the results claimed 
by the patent applicant) is not a 'useful' invention in the meaning of the patent law." See, e.g., 
Newman v. Quigg, 877 F.2d 1575, 1581, 11 USPQ2d 1340, 1345 (Fed. Cir. 1989); In re 
Harwood, 390 F.2d 985, 989, 156 USPQ 673, 676 (CCPA 1986). However, "to violate 35 
U.S.C. 101 the claimed invention must be totally incapable of achieving a useful result ." 
Brooktree Corp. v. Advanced Micro Devices, Inc., 977 F.2d 1555, 1571, 24 USPQ2d 1401, 
1412 (Fed. Cir. 1992). (emphasis added). That is, "if an invention is only partially successful 
in achieving a useful result, a rejection of the claimed invention as a whole based on a lack of 
utility is not appropriate." See, e.g., MPEP §2107.01, LL See In re Brana, 51 F.3d 1560, 34 
USPQ2d 1436 (Fed. Cir. 1995); In re Gardner, 475 F.2d 1389, 177 USPQ 396 (CCPA), reh'g 
denied, 480 F.2d 879 (CCPA 1973); In re Marzocchi, 439 F.2d 220, 169 USPQ 367 (CCPA 
1971). See, e.g., MPEP §2107.01(11). 

As discussed above, the claimed method, apparatus, recording medium and computer 
program result in establishing a security policy. Furthermore, as acknowledged by the Office 
Action on page 5, the claimed invention results at least in the adjustment of a security policy 
draft on the basis of particular differences. Thus, the claimed invention is at least partially 
successful in achieving a useful result, and therefore are not "inoperable." 
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Thus, for at least these reasons, claims 1,11, 19, 57, 59, 61 and 73 do not lack utility 
and thus satisfy 35 U.S.C. §101. Thus, for at least the reasons discussed above, claims 1,11, 
19, 57, 59, 61 and 73 do not lack utility and thus satisfy 35 U.S.C. §101. Further, claims 2- 

10, 12, 14-18, 20, 22-24, 37-54, 58, 60, 62-67 and 74-79, which variously depend from 
independent claims 1, 11, 19, 57, 59, 61 and 73, also do not lack utility and thus satisfy 35 
U.S.C. §101, for at least the reasons discussed with respect to claims 1, 11, 19, 57, 59, 61 and 
73, as well as the additional features recited therein. Withdrawal of the rejection is thus 
respectfully requested. 

11. 35 U.S.C. §112 Rejection 

The Office Action rejects claims 1-24, 37-54, 57-67 and 73-79 under 35 U.S.C. §112, 
first paragraph. This rejection is respectfully traversed. 

Claims 13 and 21 are canceled, and thus the rejection of these claims is now moot. 

The Office Action asserts that the claimed invention is not enabling because the 
details or methods of analysis critical or essential to the practice of the invention, not included 
in the claims is not enabled by the disclosure. The Office Action asserts that the steps are 
deficient in that one of ordinary skill in the art would not be able to establish the security 
policy based on this disclosure. The Office Action further asserts that the establishment of a 
security policy would require significant manipulations, organization, and description of how 
it would be implemented with the particular entities of the organization. The Office Action 
further asserts that the steps depicting the method of analysis must also be given. Finally, the 
Office asserts that no steps for the creation of the draft preparation step are provided. These 
assertions are respectfully traversed for several reasons. 

First, the features asserted are not critical to the invention. As indicated in MPEP 
§2 164.08(c), "a feature, which is taught as critical in a specification and is not recited in the 
claims should result in a rejection of such claim." See In re Mayhew, 527 F.2d 1229, 1233, 
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188 USPQ 356, 358 (CCPA 1976). However, in determining whether an unclaimed feature is 
critical, the entire disclosure must be considered. An enablement rejection based on the 
grounds that a disclosed critical limitation is missing from a claim should be made only when 
the language of the specification makes it clear that the limitation is critical for the invention 
to function as intended. 

The Office Action has only considered claim 1 in its basis for rejecting the claims 
under 35 U.S.C. §112, second paragraph. Claim 1 recites a draft preparing step, an analysis 
step, and an adjustment step to establish a security policy. The steps depicting the method of 
analysis as asserted by the Office Action are not "critical" for the invention to function as 
intended. Therefore, claim 1 satisfies 35 U.S.C. §112, first paragraph. 

Because only claim 1 was considered, the rejection under 35 U.S.C. §112, first 
paragraph is improper. The n [t]he test of enablement is whether one reasonably skilled in the 
art could make or use the invention from the disclosures in the patent coupled with 
information known in the art without undue experiment." Further, "a patent need not teach, 
and preferably omits, what is well known in the art." In re Buchner, 929 F.2d 660, 661, 18 
USPQ2d 1331, 1332 (Fed. Cir. 1991); Hybritech, inc. v. Monoclonal Antibodies, Inc., 802 
F.2d 1367, 1384, 231 USPQ 81, 94 (Fed. Cir. 1986), cert, denied, 480 U.S. 947 (1987); and 
Lindemann Maschinenfabrik GMBH v. American Hoist & Derrick Co. ,730 F.2d 1452, 1463, 
221 USPQ 481, 489 (Fed. Cir. 1984); See also, e.g., MPEP §2164.01. 

As indicated in MPEP §2 164.01 (a), there are many factors to be considered when 
determining whether there is sufficient evidence to support a determination that a disclosure 
does not satisfy the enablement requirement and whether any necessary experimentation is 
"undue." For example, these factors include, but are not limited to: 1) breadth of the claims; 
2) the nature of the invention; 3) the state of the prior art; 4) the level of one of ordinary skill; 
5) the level of predictability in the art; 6) the amount of direction provided by the inventor; 7) 
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the existence of working examples; and 8) the quantity of experimentation needed to make or 
use the invention based on the content of the disclosure. However, it is improper to conclude 
that a disclosure is not enabling based on an analysis of only one of the above factors while 
ignoring one or more of the others. The Examiner's analysis must consider all the evidence 
relates to each of these factors, and any conclusion of nonenablement must be based on the 
evidence as a whole. See In re Wands, 858 F.2d at 737, 740, 8 USPQ2d at 1404, 1407. 

The Office Action asserts that the steps recited in claim 1 are deficient in that one of 
ordinary skill in the art would not be able to establish a security policy based on the 
disclosure. However, as discussed above, the Office Action only relies on the claim 1 for this 
conclusion and has not considered the specification and/or claims 2-24, 37-54, 57-67 and 73- 
79. Thus, the 35 U.S.C. §112 rejection is improper. 

Thus, for at least the reasons discussed above, claims 1, 11, 19, 57, 59, 61 and 73 
satisfy 35 U.S.C. §112, first paragraph. Further, claims 2-10, 12, 14-18, 20, 22-24, 37-54, 58, 
60, 62-67 and 74-79, which variously depend from independent claims 1, 11, 19, 57, 59, 61 
and 73, also satisfy 35 U.S.C. §112, first paragraph, for at least the reasons discussed with 
respect to the claims 1, 1 1, 19, 57, 59, 61 and 73, as well as the additional features recited 
therein. Withdrawal of the rejection is thus respectfully requested. 
Ill, The Claims Define Patentable Subject Matter 

The Office Action rejects claims 1-24, 37-54, 57-67 and 73-79 under 35 U.S.C. 
§ 103(a) over "Information Security Policies and Procedures: A Practitioner's Guide" by 
Thomas Peltier. This rejection is respectfully traversed. 

Claims 13 and 21 are canceled, and thus the rejection of these claims is now moot. 

Claims 1-24, 37-54, 57-67 and 73-79 would not have been rendered obvious by 
Peltier. First, Peltier does not teach or suggest a method of establishing a security policy for a 
predetermined organization that includes an analyzing step that further includes "a draft 
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preparing step that includes preparing inquiries, wherein the security policy draft is prepared 
on the basis of answers to the prepared inquiries and an information system is virtually 
designed on the basis of the answers of the prepared inquiries , 1 ' as recited in claim 1. 
Nowhere does Peltier teach or suggest this feature. 

Instead, the "Development Checklist" of Peltier only discloses that a draft be written 
research and analysis of policies, procedures, and documents that are considered applicable. 
See, e.g., Peltier, pgs. 44 - 45, "14 Development Checklist." Further, Peltier only discloses 
that "a good writer should be able to create an initial draft of a policy within 8 to 16 hours." 
See, e.g., Peltier, pg. 41, "10.3 Write the Initial Draft and Prepare Illustrations." That is, 
Peltier relates to establishing a security system based on human analysis and writing ability. 
Thus, nowhere does Peltier teach or suggest constructing a virtual information system based 
on the answers of the prepared inquiries. 

Second, Peltier does not disclose "the answer acquisition step that includes at least 
one of the steps of: integrating the answers . . .; re-submitting inquiries . . .; and assigning 
weights to answers . . .," as recited in claim 11. Similarly, Peltier does not disclose an answer 
archival storage means, as recited in claim 19. That is, Peltier does not disclose a storage 
means that performs at least one of the following: integrates the answers, re-submits inquiries, 
and assigns weights to answers according to job specifications, as recited in claim 11 and as 
similarly recited in claim 19. 

Peltier, instead, only discloses an interview process that "should be used to get an 
understanding of where the organization is and how much control will be accepted." See, e.g., 
Peltier, pg. 41, "10.2 Conduct Interviews." That is, Peltier does not teach or suggest the 
claimed answer acquisition step that analyzes the answers by either integrating the answers, 
resolving contradictions between the answers, or assigning weights, from which a security 
policy is established. 
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Third, Peltier does not disclose an security policy establishment apparatus that 
includes an "an answer archival step for acquiring answers to the generated inquiries, 
integrating the answers and storing the answers into the storage means," as recited in claim 
57. Similarly, Peltier does not disclose an answer archival storage means, as recited in claim 
59. Nowhere does Peliter teach or suggest this feature. 

As discussed above, Peltier does not teach or suggest integrating the answers from the 
inquiries by an answer acquisition storage means, from which a security policy is established. 

Finally, Peltier does not disclose "a computer-readable recording medium having 
recorded thereon a program for causing a computer to perform: inquiry preparing procedures 
. . ., answer archival procedures . . ., and establishment procedures . . as recited in claim 61, 
and as similarly recited in claim 73. That is, nowhere does Peltier disclose a computer 
program that causes the computer to perform establishment procedures for establishing a 
security policy on the basis of the answers stored in the storage means. 

Instead, as discussed above, Peltier relates to establishing a security system based on 
human analysis and writing ability. 

Thus, for at least these reasons, claims 1, 1 1, 19, 57, 59, 61 and 73 are patentable over 
Peltier. Further, claims 2-10, 12, 14-18, 20, 22-24, 37-54, 58, 60, 62-67 and 74-79, which 
variously depend from independent claims 1,11, 19, 57, 59, 61 and 73, are also patentable 
over Peltier, for at least the reasons discussed with respect to claims 1, 11, 19, 57, 59, 61 and 
73, as well as the additional features recited therein. Withdrawal of the rejection is thus 
respectfully requested. 
IV. Conclusion 

In view of the foregoing, it is respectfully submitted that this application is in 
condition for allowance. Favorable reconsideration and prompt allowance are earnestly 
solicited. 
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Should the Examiner believe that anything further would be desirable in order to place 
this application in even better condition for allowance, the Examiner is invited to contact the 
undersigned at the telephone number set forth below. 



Respectfully submitted, 




James A. Oliff 
Registration No. 27,075 



Randi B. Isaacs 
Registration No. 56,046 

JAO:RBI/jfb 

Attachment: 

Petition for Extension of Time 

Date: November 1 , 2005 

DEPOSIT ACCOUNT USE 
Oliff & Berridge, plc AUTHORIZATION 
P.O. Box 19928 Please grant any extension 

Alexandria, Virginia 22320 necessary for entry; 

Telephone: (703) 836-6400 Charge any fee due to our 

Deposit Account No. 15-0461 
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